What is the CVSS score of CVE-2023-48311?

CVE-2023-48311 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2023-48311?

Yes, a patch is available for CVE-2023-48311. Update the affected software to the latest version immediately.

Docker CVE-2023-48311

MEDIUM

Improper Input Validation (CWE-20)

2023-12-08 security-advisories@github.com

Information Disclosure Docker Dockerspawner

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 08, 2023 - 20:15 nvd

MEDIUM 4.3

DescriptionNVD

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit 3ba4b665b which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior.

AnalysisAI

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-20. dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit 3ba4b665b which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior. Affected products include: Jupyter Dockerspawner. Version information: version 13..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.